Merge branch 'feature/KASM-8210_bump_dep_versions_for_1_19_0' into 'develop'

KASM-8210 bump Docker to 29.4.3 and fix CI compatibility issues Closes KASM-8210 See merge request kasm-technologies/internal/workspaces-images!421
2026-07-17 16:40:14 +00:00 · 2026-05-18 20:36:02 +00:00 · 2026-05-18 20:36:02 +00:00 · c2ea2e38fc
commit c2ea2e38fc
parent 3490ca084b fa7471dba7
8 changed files with 117 additions and 19 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,4 @@
+# Claude Code AI data files — excluded from Docker builds
+.claude/
+claude_files/
+CLAUDE.md
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -1,9 +1,9 @@
 ############
 # Settings #
 ############
-image: docker:24.0.6
+image: docker:29.4.3
 services:
-  - docker:24.0.6-dind
+  - docker:29.4.3-dind
 stages:
  - template
  - run
@ -13,6 +13,7 @@ variables:
  KASM_RELEASE: "1.18.0"
  TEST_INSTALLER: "https://kasm-static-content.s3.amazonaws.com/kasm_release_1.18.0.09f70a.tar.gz"
  MIRROR_ORG_NAME: "kasmtech"
+  DOCKER_AUTH_CONFIG: ${_DOCKER_AUTH_CONFIG}
 default:
  retry: 2
 before_script:
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -0,0 +1,87 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Workspaces Images is the catalog of pre-built Kasm workspace images (applications and full desktops) published to DockerHub and Quay. Each image layers application-specific install scripts on top of a base image from [workspaces-core-images](https://gitlab.com/kasm-technologies/internal/workspaces-core-images).
+
+## Repository Layout
+
+```
+dockerfile-kasm-<name>      # Flat Dockerfile per image at repo root
+src/
+  ubuntu/install/<app>/     # Install scripts for Ubuntu-based images
+  common/                   # Shared scripts used across distros
+  alpine/, opensuse/, ...   # Distro-specific install scripts
+ci-scripts/
+  template-vars.yaml        # Image manifest: name, base, dockerfile, changeFiles, runset
+  template-gitlab.py        # Generates gitlab-ci.yml from template-vars.yaml
+  build.sh                  # Builds + pushes to cache registry
+  test.sh                   # Runs post-build smoke tests via AWS/curl
+  manifest.sh               # Creates and pushes multi-arch manifests
+  weekly-manifest.sh        # Scheduled rolling-tag manifest updates
+```
+
+## Building Images Locally
+
+```bash
+# Build a single image (run from repo root)
+sudo docker build -t kasmweb/firefox:dev -f dockerfile-kasm-firefox .
+
+# Run it locally
+sudo docker run --rm -it --shm-size=512m -p 6901:6901 -e VNC_PW=password kasmweb/firefox:dev
+# Access via browser: https://<IP>:6901  (user: kasm_user, password: password)
+```
+
+The `BASE_TAG` build arg controls which core image tag is pulled (default: `develop`). Override with `--build-arg BASE_TAG=<tag>` to build against a specific core release.
+
+## Adding a New Image
+
+1. Create `dockerfile-kasm-<name>` at the repo root. Use an existing dockerfile as a template — the pattern is:
+   - Set `ARG BASE_IMAGE` / `ARG BASE_TAG` and `FROM kasmweb/$BASE_IMAGE:$BASE_TAG`
+   - Add install scripts under `src/<distro>/install/<name>/`
+   - Copy scripts into `$INST_SCRIPTS`, run them, then delete them
+   - Fix ownership with `chown 1000:0 $HOME` and run `set_user_permission.sh`
+   - End with `USER 1000`
+
+2. Add an entry to `ci-scripts/template-vars.yaml`:
+   ```yaml
+   - name: <name>
+     runset: set-a          # or set-b — distributes load across CI run sets
+     singleapp: true        # false for full desktop images
+     base: core-ubuntu-jammy  # or core-ubuntu-noble, core-debian-bookworm, etc.
+     dockerfile: dockerfile-kasm-<name>
+     changeFiles:
+       - dockerfile-kasm-<name>
+       - src/ubuntu/install/<name>/**
+   ```
+
+3. The CI pipeline is generated — do **not** edit `gitlab-ci.yml` directly; edit `template-vars.yaml` and `template-gitlab.py` instead.
+
+## CI/CD
+
+The pipeline runs in two stages:
+
+1. **template** — `template-gitlab.py` reads `template-vars.yaml` and generates `gitlab-ci.yml` as a CI artifact.
+2. **run** — triggers a child pipeline from the generated `gitlab-ci.yml`.
+
+Key CI variables (set in GitLab or pipeline triggers):
+- `BASE_TAG` — core image tag to build against (default: `develop`)
+- `USE_PRIVATE_IMAGES` — set to `1` to pull from private registry
+- `KASM_RELEASE` — release version string for test installer
+- `RUN_SET` — restrict CI to `set-a` or `set-b` image subsets
+- `MIRROR_ORG_NAME` — DockerHub org for mirror pushes (default: `kasmtech`)
+
+On `develop` and `release/*` branches, images are pushed publicly to DockerHub and Quay. Feature branches push only to an internal cache registry tagged `<arch>-<name>-<branch>-<pipeline_id>`.
+
+## Image Naming Conventions
+
+- Single-app images use `singleapp: true` and strip the XFCE panel for a focused UI.
+- Desktop images (`singleapp: false`) ship the full XFCE desktop environment.
+- Base image names follow `core-<distro>-<codename>` (e.g. `core-ubuntu-jammy`, `core-ubuntu-noble`, `core-debian-bookworm`).
+- Published tags: `kasmweb/<name>:<branch>` for branch builds, `kasmweb/<name>:<version>` for releases.
+
+## Distro Support
+
+Install scripts are organized under `src/<distro>/install/<app>/`. Ubuntu scripts (jammy/noble) are the most common. When adding support for a new distro, add scripts under the appropriate `src/<distro>/` subtree and reference them in the dockerfile.
--- a/ci-scripts/build.sh
+++ b/ci-scripts/build.sh
@ -11,7 +11,7 @@ if [[ ${USE_PRIVATE_IMAGES} -eq 1 ]]; then
 fi

 ## Build/Push image to cache endpoint by pipeline ID ##
-docker build \
+docker build --provenance=false \
  -t ${ORG_NAME}/image-cache-private:$(arch)-${NAME}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID} \
  --build-arg BASE_IMAGE="${BASE}" \
  --build-arg BASE_TAG="${BASE_TAG}" \
--- a/ci-scripts/gitlab-ci.template
+++ b/ci-scripts/gitlab-ci.template
@ -1,9 +1,9 @@
 ############
 # Settings #
 ############
-image: docker:29.4.0
+image: docker:29.4.3
 services:
-  - docker:29.4.0-dind
+  - docker:29.4.3-dind
 stages:
  - readme
  - revert
@ -45,9 +45,9 @@ include:
 {% for IMAGE in multiImages %}
 build_{{ IMAGE.name }}:
  stage: build
-  image: docker:28.2.2
+  image: docker:29.4.3
  services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
  extends:
    - .run_rules
    - .monitor-in-grafana
@ -78,9 +78,9 @@ build_{{ IMAGE.name }}:
 {% for IMAGE in singleImages %}
 build_{{ IMAGE.name }}:
  stage: build
-  image: docker:28.2.2
+  image: docker:29.4.3
  services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
  extends:
    - .run_rules
    - .monitor-in-grafana
@ -173,9 +173,9 @@ test_{{ IMAGE.name }}:
 {% for IMAGE in multiImages %}
 manifest_{{ IMAGE.name }}:
  stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
  services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
  extends:
    - .run_rules
    - .monitor-in-grafana
@ -210,9 +210,9 @@ manifest_{{ IMAGE.name }}:
 {% for IMAGE in singleImages %}
 manifest_{{ IMAGE.name }}:
  stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
  services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
  extends:
    - .run_rules
    - .monitor-in-grafana
@ -251,9 +251,9 @@ manifest_{{ IMAGE.name }}:
 {% for IMAGE in multiImages %}
 weekly_manifest_{{ IMAGE.name }}:
  stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
  services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
  extends:
    - .run_rules
    - .monitor-in-grafana
@ -273,9 +273,9 @@ weekly_manifest_{{ IMAGE.name }}:
 {% for IMAGE in singleImages %}
 weekly_manifest_{{ IMAGE.name }}:
  stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
  services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
  extends:
    - .run_rules
    - .monitor-in-grafana
--- a/ci-scripts/manifest.sh
+++ b/ci-scripts/manifest.sh
@ -79,7 +79,7 @@ if [[ "${TYPE}" == "multi" ]]; then

  # Pull images from cache repo
  docker pull ${ORG_NAME}/image-cache-private:x86_64-${NAME}-${PULL_BRANCH}-${CI_PIPELINE_ID}
-  docker pull ${ORG_NAME}/image-cache-private:aarch64-${NAME}-${PULL_BRANCH}-${CI_PIPELINE_ID}
+  docker pull --platform linux/arm64 ${ORG_NAME}/image-cache-private:aarch64-${NAME}-${PULL_BRANCH}-${CI_PIPELINE_ID}

  # Tag images to live repo
  docker tag \
--- a/ci-scripts/test.sh
+++ b/ci-scripts/test.sh
@ -164,6 +164,12 @@ for IP in "${IPS[@]}"; do
  done
 done

+# Materialize docker config from env var if docker login was not run
+if [ ! -f /root/.docker/config.json ] && [ -n "${DOCKER_AUTH_CONFIG:-}" ]; then
+  mkdir -p /root/.docker
+  printf '%s' "${DOCKER_AUTH_CONFIG}" > /root/.docker/config.json
+fi
+
 # Copy over docker auth
 for IP in "${IPS[@]}"; do
  scp \
--- a/src/ubuntu/install/redroid/install_redroid.sh
+++ b/src/ubuntu/install/redroid/install_redroid.sh
@ -13,6 +13,6 @@ apt-get install -y  android-tools-adb android-tools-fastboot \

 mkdir -p /opt/
 cd /opt/
-git clone https://github.com/Genymobile/scrcpy
+git clone --depth 1 --branch v3.3.4 https://github.com/Genymobile/scrcpy
 cd scrcpy
 ./install_release.sh